diff --git a/.gitea/workflows/prod-tag-deploy.yml b/.gitea/workflows/prod-tag-deploy.yml
index 1dab77d..5b0a80e 100644
--- a/.gitea/workflows/prod-tag-deploy.yml
+++ b/.gitea/workflows/prod-tag-deploy.yml
@@ -101,11 +101,13 @@ jobs:
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
-      - name: Resolve node:20-alpine (Gitea mirror, then local, then Hub)
+      - name: Resolve node:20-alpine (Gitea, then mirrors, Hub last)
         run: |
           $ErrorActionPreference = 'Stop'
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
-          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix
+          $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
+          if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix -ExtraSources $extra
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend (tag only, not :latest)
diff --git a/.gitea/workflows/registry-build-deploy.yml b/.gitea/workflows/registry-build-deploy.yml
index d00c527..aa9066e 100644
--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -17,6 +17,8 @@
 #   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
 #   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
 #   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
+#   NODE_IMAGE_SOURCE    extra base-image ref(s), comma-separated, tried before built-in mirrors
+#                        e.g. docker.arvancloud.ir/library/node:20-alpine
 #
 # Same Windows PC runs Gitea + runner + deploy:
 #   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
@@ -84,11 +86,13 @@ jobs:
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
-      - name: Resolve node:20-alpine (Gitea mirror, then local, then Hub)
+      - name: Resolve node:20-alpine (Gitea, then mirrors, Hub last)
         run: |
           $ErrorActionPreference = 'Stop'
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
-          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix
+          $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
+          if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix -ExtraSources $extra
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend
diff --git a/infrastructure/STAGING-DEPLOY.md b/infrastructure/STAGING-DEPLOY.md
index cd378d9..9eeb47d 100644
--- a/infrastructure/STAGING-DEPLOY.md
+++ b/infrastructure/STAGING-DEPLOY.md
@@ -300,7 +300,7 @@ On the Windows host, from repo `infrastructure/`:
 | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
 | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
 | `413 Request Entity Too Large` on `docker push` to `https://gitea.wixur.ir/v2/…/blobs/uploads` | Nginx (or Cloudflare) in front of Gitea is rejecting the image layer. **Fix the proxy** (then `nginx -s reload`): in the `server { server_name gitea.wixur.ir; }` block set `client_max_body_size 0;` and `proxy_request_buffering off;` — snippet: [`nginx/windows-gitea.wixur.snippet.conf`](nginx/windows-gitea.wixur.snippet.conf). **Or skip the proxy:** set `REGISTRY_HOST=host.docker.internal:3000` (and Gitea `ROOT_URL`) so CI pushes to `:3000`. If the hostname is orange-clouded on Cloudflare, grey-cloud it (free plan caps uploads at 100MB). |
-| `TLS handshake timeout` to `registry-1.docker.io` / `node:20-alpine` | Docker Hub unreachable from the Windows runner. CI mirrors `node:20-alpine` into Gitea (`<REGISTRY_PREFIX>/node:20-alpine`) and builds from that. If Hub is down **and** the image is not on the machine: on the runner run `docker pull node:20-alpine` when Hub works, then re-run the workflow. Optional Docker Engine `registry-mirrors`. |
+| `TLS handshake timeout` to `registry-1.docker.io` / `node:20-alpine` | Docker Hub is blocked or slow from the Windows runner. CI pulls `node:20-alpine` from **Arvan / ECR Public / GCR**, then pushes `<REGISTRY_PREFIX>/node:20-alpine` to Gitea (later builds skip Hub). Optional variable `NODE_IMAGE_SOURCE` (comma-separated image refs). One-time on the runner: `docker pull docker.arvancloud.ir/library/node:20-alpine` then tag/push to Gitea. |
 | `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
 | `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
 | `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
diff --git a/infrastructure/scripts/ci-resolve-node-image.ps1 b/infrastructure/scripts/ci-resolve-node-image.ps1
index e62d5de..901f805 100644
--- a/infrastructure/scripts/ci-resolve-node-image.ps1
+++ b/infrastructure/scripts/ci-resolve-node-image.ps1
@@ -1,10 +1,11 @@
 # Prefer a Gitea-hosted node:20-alpine so docker build does not HEAD registry-1.docker.io.
-# Order: local Gitea tag -> pull Gitea -> local Docker Hub tag -> pull Hub (retries) -> tag/push Gitea.
+# Order: Gitea -> optional NODE_IMAGE_SOURCE -> regional/official mirrors -> Docker Hub last.
 # ASCII only: Windows PowerShell 5.1 + act_runner mis-parses backtick escapes in this file.
 param(
   [Parameter(Mandatory = $true)][string]$RegistryPrefix,
   [string]$OutFile = '.ci-node-image',
-  [string]$HubImage = 'node:20-alpine'
+  [string]$HubImage = 'node:20-alpine',
+  [string]$ExtraSources = ''
 )
 
 $ErrorActionPreference = 'Continue'
@@ -21,7 +22,7 @@ function Invoke-Pull([string]$Name, [int]$Attempts) {
     Write-Host "docker pull $Name (attempt $i/$Attempts)"
     docker pull $Name
     if ($LASTEXITCODE -eq 0) { return $true }
-    if ($i -lt $Attempts) { Start-Sleep -Seconds (10 * $i) }
+    if ($i -lt $Attempts) { Start-Sleep -Seconds 5 }
   }
   return $false
 }
@@ -33,39 +34,66 @@ function Save-Choice([string]$Name) {
   Write-Host "NODE_IMAGE=$Name"
 }
 
+function Publish-Mirror([string]$Src) {
+  Write-Host "Tagging $Src as $mirror"
+  docker tag $Src $mirror
+  if ($LASTEXITCODE -ne 0) { return $false }
+  docker push $mirror
+  if ($LASTEXITCODE -ne 0) {
+    Write-Host "Could not push $mirror - docker build will use the local tag (legacy builder)."
+    $flag = Join-Path (Get-Location) '.ci-use-legacy-builder'
+    New-Item -ItemType File -Path $flag -Force | Out-Null
+  }
+  Save-Choice $mirror
+  return $true
+}
+
 if (Test-Image $mirror) {
   Write-Host "Using local $mirror"
   Save-Choice $mirror
   exit 0
 }
 
-if (Invoke-Pull $mirror 2) {
+if (Invoke-Pull $mirror 1) {
   Save-Choice $mirror
   exit 0
 }
 
-if (-not (Test-Image $HubImage)) {
-  if (-not (Invoke-Pull $HubImage 5)) {
-    Write-Host "Cannot pull $HubImage from Docker Hub (TLS timeout or blocked)."
-    Write-Host "On the Windows runner, when Hub is reachable:"
-    Write-Host "  docker pull $HubImage"
-    Write-Host "  docker tag $HubImage $mirror"
-    Write-Host "  docker push $mirror"
-    Write-Host "Then re-run this workflow."
-    exit 1
+$sources = New-Object System.Collections.ArrayList
+if (-not [string]::IsNullOrWhiteSpace($ExtraSources)) {
+  foreach ($part in ($ExtraSources -split ',')) {
+    $src = $part.Trim()
+    if ($src.Length -gt 0) { [void]$sources.Add($src) }
+  }
+}
+# Iran-reachable proxy of Docker Hub official images, then public official mirrors, Hub last.
+foreach ($src in @(
+    'docker.arvancloud.ir/library/node:20-alpine',
+    'public.ecr.aws/docker/library/node:20-alpine',
+    'mirror.gcr.io/library/node:20-alpine',
+    $HubImage
+  )) {
+  if (-not $sources.Contains($src)) { [void]$sources.Add($src) }
+}
+
+foreach ($src in $sources) {
+  if (Test-Image $src) {
+    Write-Host "Found local $src"
+    if (Publish-Mirror $src) { exit 0 }
   }
 }
 
-Write-Host "Tagging $HubImage as $mirror"
-docker tag $HubImage $mirror
-if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-docker push $mirror
-if ($LASTEXITCODE -ne 0) {
-  Write-Host "Could not push $mirror - docker build will use the local tag (legacy builder)."
-  $flag = Join-Path (Get-Location) '.ci-use-legacy-builder'
-  New-Item -ItemType File -Path $flag -Force | Out-Null
+foreach ($src in $sources) {
+  if (Invoke-Pull $src 2) {
+    if (Publish-Mirror $src) { exit 0 }
+  }
 }
 
-Save-Choice $mirror
-exit 0
+Write-Host "Could not pull node:20-alpine from Gitea, mirrors, or Docker Hub."
+Write-Host "Set repository variable NODE_IMAGE_SOURCE to a reachable image, for example:"
+Write-Host "  docker.arvancloud.ir/library/node:20-alpine"
+Write-Host "Or on the Windows runner:"
+Write-Host "  docker pull docker.arvancloud.ir/library/node:20-alpine"
+Write-Host "  docker tag docker.arvancloud.ir/library/node:20-alpine $mirror"
+Write-Host "  docker push $mirror"
+exit 1